Ruby Iteration in Logstash help

Elastic Stack Logstash
1

i have a parsed xml data that looks like this:

"ObjLdn_Value" => [
    [0] "PoolType=necc, PoolId=0, PoolMember=0, Machine=XXXXXX1, UUID=ABCDABCD1",
    [1] "PoolType=necc, PoolId=0, PoolMember=1, Machine=XXXXXX2, UUID=ABCDABCD2",
    [2] "PoolType=necc, PoolId=0, PoolMember=2, Machine=XXXXXX3, UUID=ABCDABCD3"
],
     "endTime" => [
    [0] "2020-03-02T10:15:00+01:00"
],
   "TypeValue" => [
    [ 0] "0",
    [ 1] "100.00",
    [ 2] "26777.00",
    [ 3] "361.00",
    [ 4] "0",
    [ 5] "100.00",
    [ 6] "20214.00",
    [ 7] "312.00",
    [ 8] "0",
    [ 9] "100.00",
    [10] "18203.00",
    [11] "15213.00"
],
        "Type" => [
    [0] "VS.ScdrsTranferredOverBp",
    [1] "VS.swapMemUsage",
    [2] "VS.MemUsedSize",
    [3] "VS.MemAvailableSize"
],

the amount of entries in Type, TypeValue and ObjLdn_Value is different each event.

i want to Create an Output that Loks like this:

"ObjLdn_Value[0]" has 4 KeyValue Pairs "Type[0,1,2,3]" with the Values "TypeValue[0,1,2,3]"

"ObjLdn_Value[1]" has 4 KeyValue Pairs "Type[0,1,2,3]" with the Values "TypeValue[4,5,6,7]"
and
"ObjLdn_Value[2]" has 4 KeyValue Pairs "Type[0,1,2,3]" with the Values "TypeValue[8,9,10,11]"

but i am uterly lost. i assume i need to use some ruby code for that?

Any help would be appriciated.

2

Is that in any way related to the input?

3

yes it is. one ObjLdn_Value has all Types, and each Type has one TypeValue.

here is what the original xml looked like.

<measInfo>
		<granPeriod duration="PT900S" endTime="2020-03-02T10:15:00+01:00" />
		<measType p="1">VS.ScdrsTranferredOverBp</measType>
		<measType p="2">VS.swapMemUsage</measType>
		<measType p="3">VS.MemUsedSize</measType>
		<measType p="4">VS.MemAvailableSize</measType>
		<measValue measObjLdn="PoolType=necc, PoolId=0, PoolMember=0, Machine=XXXXXX1, UUID=ABCDABCD1">
			<r p="1">0</r>
			<r p="2">100.00</r>
			<r p="3">26777.00</r>
			<r p="4">361.00</r>
		</measValue>
		<measValue measObjLdn="PoolType=necc, PoolId=0, PoolMember=1, Machine=XXXXXX2, UUID=ABCDABCD2">
			<r p="1">0</r>
			<r p="2">100.00</r>
			<r p="3">20214.00</r>
			<r p="4">312.00</r>
		</measValue>
		<measValue measObjLdn="PoolType=necc, PoolId=0, PoolMember=2, Machine=XXXXXX3, UUID=ABCDABCD3">
			<r p="1">0</r>
			<r p="2">100.00</r>
			<r p="3">18203.00</r>
			<r p="4">15213.00</r>
		</measValue>
	</measInfo>
4

OK, I am unclear on what output format you want. Also, if the arrays are all ordered lists then we can make assumptions and ignore the value of p. The following code does no error checking, makes assumptions about your data format, and I apologize if my ruby coding style makes anyone's eyeballs bleed, but it should give you an idea of what your code would need to do...

    xml { source => "message" target => "[@metadata][theXML]" force_array => false }
    ruby {
        code => '
            xml = event.get("[@metadata][theXML]")
            types = xml["measType"]
            values = xml["measValue"]
            a = []
            values.each { |x|
                h = {}
                h["measObjLdn"] = x["measObjLdn"]
                x["r"].each_index { |i|
                    h[types[i]["content"]] = x["r"][i]["content"]
                }
                a << h
            }
            event.set("data", a)
        '
    }

will produce

      "data" => [
    [0] {
                  "VS.MemUsedSize" => "26777.00",
             "VS.MemAvailableSize" => "361.00",
                      "measObjLdn" => "PoolType=necc, PoolId=0, PoolMember=0, Machine=XXXXXX1, UUID=ABCDABCD1",
        "VS.ScdrsTranferredOverBp" => "0",
                 "VS.swapMemUsage" => "100.00"
    },
    [1] {
                  "VS.MemUsedSize" => "20214.00",
             "VS.MemAvailableSize" => "312.00",
                      "measObjLdn" => "PoolType=necc, PoolId=0, PoolMember=1, Machine=XXXXXX2, UUID=ABCDABCD2",
        "VS.ScdrsTranferredOverBp" => "0",
                 "VS.swapMemUsage" => "100.00"
    },
    [2] {
                  "VS.MemUsedSize" => "18203.00",
             "VS.MemAvailableSize" => "15213.00",
                      "measObjLdn" => "PoolType=necc, PoolId=0, PoolMember=2, Machine=XXXXXX3, UUID=ABCDABCD3",
        "VS.ScdrsTranferredOverBp" => "0",
                 "VS.swapMemUsage" => "100.00"
    }
],
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.